Mailman 3 January 2009 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 07 Nov '22

07 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

mailman-pgp-smime: talks at FOSDEM and in Ulm, new release
by Joost van Baal 05 Mar '09

05 Mar '09

Hi, Thanks to the NLnet foundation, the Secure List Server project ( http://non-gnu.uvt.nl/mailman-pgp-smime/ ) , which is including OpenPGP and S/MIME support in Mailman has released a much improved mailman-pgp-smime patch: http://non-gnu.uvt.nl/pub/mailman/mailman-2.1.11-pgp-smime_2009-01-02.patch… . See http://non-gnu.uvt.nl/mailman-pgp-smime/NEWS.PGP-SMIME for the details. There'll be talks about this patch: On monday january 12 I'll talk at the Chaos Seminar</a> in Ulm, Germany, see http://ulm.ccc.de/ChaosSeminar/2009/01_Mailman_PGP_SMIME . On sunday february 8th, 10h20 (probably), I'll give a lightning talk at the FOSDEM conference, ULB Campus Solbosch, Brussels, Belgium. See http://fosdem.org/2009/node/164. The talk will start with a very short overview of the history of Mailman and the mailman-pgp-smime project. Some remarks will be made on how to install and configure the software, so that one can try it. Currently supported features will be mentioned, as well as an overview of development plans. One will learn how to contribute to the project; an overview of the revision control system used will be given. Some remarks on the future of the patch will be made: will it be shipped with Mailman itself? If you have used Mailman, both as a subscriber and as a list admin, and if you know what PGP and S/MIME are, you should definitely attend this talk. Hope to meet you there! Bye, Joost -- irc:joostvb@{OFTC,freenode} ∙ http://mdcc.cx/ ∙ http://ad1810.com/

3 5

buildout problems solved
by Barry Warsaw 04 Feb '09

04 Feb '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks to help from the distutils sig, I believe I've solved the buildout problems that were discussed here a while back. By moving the mailman source tree into an 'src' subdirectory, buildout now works regardless of whether you're sharing eggs via ~/.buildout/default.cfg or not. Please give the current 3.0 bzr tree a try. If you want me to cut a new release with the fixes I can do that too. Barry -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) iEYEARECAAYFAkl8q0kACgkQ2YZpQepbvXEPWgCeOU3YsBU8FmQc25dNpzP4Gm7r 3/EAn3n7yI6x/I3MgmYPB85qjeoBOsz+ =dQGr -----END PGP SIGNATURE-----

2 8

ANNOUNCE: GNU Mailman 3.0a2 (Grand Designs)
by Barry Warsaw 19 Jan '09

19 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Mailpersons, I'm happy to announce the availability of GNU Mailman version 3.0 alpha 2, code name "Grand Designs". Of course, this is still an alpha snapshot and not suitable for production systems, however there is a lot of good functional stuff in this release that is worthy of a look. Because this is still alpha software, you can have a big influence on where the code goes from here. I'm especially interested in feedback from integrators, and I welcome your contribution. Mailman 3.0 alpha 2 should be functional enough to create mailing lists, connect them to your MTA, add and remove members, and send email to those lists. Incoming mail integration is currently only supported for Postfix via LMTP; contributions for other MTAs and incoming mechanisms are welcome. The web interface is still not functional, so for now you have to interact with Mailman via the command line. Please feel free to discuss Mailman 3 development on the mailman- developers mailing list. You can submit branches and bugs to the Launchpad bug tracker at https://bugs.launchpad.net/mailman For detailed information on 3.0a2, please read docs/ALPHA.txt. This file explains how to build Mailman and run the test suite. The docs/ NEWS.txt file contains high level descriptions of what's changed since 3.0a1. Most notably are the new configuration system, the better test suite and installation process, and the new LMTP support. Mailman 3 also contains extensive doctests which explain how certain subsystems work. Please note that Python 2.6 is required. You can download the tarball either from the Cheeseshop or from Launchpad. An egg is available on the Cheeseshop. See: http://pypi.python.org/pypi/mailman/3.0.0a2 https://launchpad.net/mailman/+download for details. I hope you find this second snapshot useful and encouraging. Please participate! Enjoy, B. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) iEYEARECAAYFAklfuV8ACgkQ2YZpQepbvXGRzACeLPvX9eeaPj4x9viw6qZqxgUA sawAn0iDsOHBMM6+RzfUJSQX9RORZTy/ =tTMG -----END PGP SIGNATURE-----

5 6

Mailman 2.x Roadmap
by Mark Sapiro 12 Jan '09

12 Jan '09

Barry has been making wonderful progress with Mailman 3.0 and has just announced the second alpha release. This may leave some of you wondering what's happening with the Mailman 2.x series, so this note is for all interested Mailman users, developers and translators to give an idea of what to expect in Mailman 2.x in the coming months. Within the next few days, I plan to release Mailman 2.1.12rc1. This release contains several minor bug fixes since 2.1.11 and is updated for compatibility with Python 2.6. It will not work with Python older than 2.4. In the absence of "show stopping" bugs, the only changes between this and the final 2.1.12 release will be translation updates. I expect to release the final by the end of January. After January, my focus will be on Mailman 2.2. This branch was originally intended to be an overhaul of Mailman's GUI, but that work is stalled and will be deferred to Mailman 2.3 or 3.0. The focus of Mailman 2.2 will be ongoing maintenance of the 2.x series and several small new features that have not been added in the 2.1 branch because of i18n considerations. I hope to be able to release a 2.2 beta before the end of March, 2009. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

4 10

"Orignal" MySQL Member Adaptor - 1.71
by Kyrian (list) 08 Jan '09

08 Jan '09

All, I finally managed to find some vestige of free time after midnight (hardly the best time to be coding...) recently, and accordingly put out a new version of my MySQL MemberAdaptor. I have no time, and little motivation (no customers wanting to use it at the present time) to test it, so I haven't, but you're welcome to try it out. It should according to the docs I found, provided I've applied them correctly, fix the non-ASCII character encoding problems (I've relied on the assertions about list members to cover that angle, and just checked encoding on the 'user supplied' parameters to various function calls). Now would be a good time for someone to send me a Python language reference book ;-) However since I've changed development environment since the last version, it's possible that various things have gone wrong (certainly the version numbering has gone mad between RCS and CVS/Eclipse), so don't do it in a production environment. I've put it here, as version 1.71, whatever that might actually mean: http://www.orenet.co.uk/opensource/MailmanMysql/ Incidentally, since Fil seems to be taking all the credit for what I started I think he should actually put a proper credit in there for me, linking to my business website at http://www.orenet.co.uk/ rather than the vague passing mentions that are in the docs/code of his version of the system at the present time. With luck I will be able to coax one of my customers into 'sponsoring' further development of the MySQL Adaptor with proper integration into Mailman in a sane way that is agreed by everyone instead of (as seems to be the case from what little of this list I have had time to read) just going off on its own sweet way and reducing the likelyhood of acceptance into the main code base of Mailman, but I am not sure how that will go. If anyone else wants to sponsor my time to code this thing better and further, then just email me. Best of luck with it, whatever happens. More updates in whichever year I manage to find spare/free time. Yours Sincerely, Kev Green.

7 19

Mailman 3 and LTMP
by Barry Warsaw 07 Jan '09

07 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi William, The Mailman 3 branch is nearly ready for the next alpha release. I've been working on some major structural changes that should make development go much faster. First, I've converted the installation infrastructure over to zc.buildout. This is a easy to use, but powerful way to build and deploy Mailman, and it helps manage dependencies in a transparent way. Second, I've converted much, but not all, of the configuration system over to lazr.config, which provides a nice way to stack ini- style configurations. For now, you still have to manually edit Defaults.py for some things, but I plan on finishing that conversion after the next release. The state of the branch is nearly functional on its own, minus the web interface. This provides a nice platform for integrating MM3 with external systems. I do plan on implementing the REST admin interface next. The one hang up currently is incoming mail. I think it would simplify things if we shipped MM3 with LTMP support out of the box. William has done a lot of work to improve the LMTP server in MM3 and I'd like to go about integrating that into the main line. There are a few problems with William's branch though: lp:~wilunix/ mailman/lmtp First, it seems like the initial revision was not made from a branch of the main line, but instead imported into revision 1. This makes it much more difficult to suss out the differences in William's branch, especially with tracking the changes to the main branch since then. Second, there seems to be a bunch of extraneous files committed in William's branch, such as log files and database files. These clearly need to be removed before the branch can be merged. William, please contact me off-list so that we can address these. We'll also need to have a chat about FSF copyright assignments. Finally, I would like to get input from MTA experts on this list as to the best way to integrate the various MTAs with Mailman's LMTP server. Specifically, I'm looking at fixing and improving bin/ genaliases for each of the MTAs. I've looked at Postfix's documentation, but sadly to me it seems quite lacking as to best recommendations. I know Exim and Sendmail support LTMP, but I don't have as much experience with hooking them up. If you have input on the best way to connect Mailman and an MTA via LMTP, please add it to this page: http://wiki.list.org/display/DEV/LMTP+process and follow up to this message. Thanks and Happy New Year. - -Barry -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) iEYEARECAAYFAkleSbAACgkQ2YZpQepbvXG+PgCeI4eVhv+mVppcVkz+0iG280j0 GXUAoK97Q1VtodePjaNaBMB6PzP//9U+ =EOD1 -----END PGP SIGNATURE-----

4 12

Doubt about security
by Edilson Azevedo 05 Jan '09

05 Jan '09

Hi Developers! I've a question: Why in all lists sites that I look, the "Admin Links" is open? Worst: Why (inside the Admin Links) the link "create a new mailing list" is open? Anyone in anywhere can to try until discover the Admin password?? My doubt is: Why those links are open to world? I think that it's very insecure, or not?!? Thanks folks!!! -- Edilson Azevedo Mail / Gtalk: eazevedo(a)bsd.com.br

7 15